Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Service Networking Publication] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Service Networking Publication] 'ImagePath' = 'C:\wcneprogrigjtjz\gctcymbfjgmf.exe'
Creates the following services
- 'Service Networking Publication' C:\wcneprogrigjtjz\gctcymbfjgmf.exe
Modifies file system
Creates the following files
- %WINDIR%\wcneprogrigjtjz\dxdrgyie
- C:\wcneprogrigjtjz\dxdrgyie
- C:\wcneprogrigjtjz\m6pksot3tdan4ozrp.exe
- C:\wcneprogrigjtjz\gctcymbfjgmf.exe
- C:\wcneprogrigjtjz\iswtwfuxqiv.exe
- C:\wcneprogrigjtjz\gimzfewyams
Sets the 'hidden' attribute to the following files
- C:\wcneprogrigjtjz\gctcymbfjgmf.exe
- C:\wcneprogrigjtjz\iswtwfuxqiv.exe
Deletes the following files
- %WINDIR%\wcneprogrigjtjz\dxdrgyie
- C:\wcneprogrigjtjz\m6pksot3tdan4ozrp.exe
Substitutes the following files
- %WINDIR%\wcneprogrigjtjz\dxdrgyie
Network activity
Connects to
- 'be####behind.net':80
- 'ga####behind.net':80
- 'be####butter.net':80
- 'fl###broad.net':80
- 'br###butter.net':80
- 'se####butter.net':80
- 'ni###dried.net':80
- 'st####article.net':80
TCP
HTTP GET requests
- http://be####behind.net/index.php
- http://ga####behind.net/index.php
- http://be####butter.net/index.php
- http://fl###broad.net/index.php
- http://br###butter.net/index.php
- http://se####butter.net/index.php
- http://ni###dried.net/index.php
- http://st####article.net/index.php
UDP
- DNS ASK st####butter.net
- DNS ASK ga###rangry.net
- DNS ASK be###rangry.net
- DNS ASK ga####fifteen.net
- DNS ASK be####fifteen.net
- DNS ASK ga###rdried.net
- DNS ASK be###rdried.net
- DNS ASK tr####rticle.net
- DNS ASK st####article.net
- DNS ASK tr###angry.net
- DNS ASK st###tangry.net
- DNS ASK tr####ifteen.net
- DNS ASK st####fifteen.net
- DNS ASK tr###dried.net
- DNS ASK st###tdried.net
- DNS ASK el####icarticle.net
- DNS ASK re####article.net
- DNS ASK el####icangry.net
- DNS ASK re###dangry.net
- DNS ASK el####icfifteen.net
- DNS ASK re####fifteen.net
- DNS ASK el####icdried.net
- DNS ASK be####article.net
- DNS ASK fl###dried.net
- DNS ASK do###river.net
- DNS ASK br###dried.net
- DNS ASK ag####triver.net
- DNS ASK do####ervice.net
- DNS ASK ag####tservice.net
- DNS ASK do####uppose.net
- DNS ASK ag####tsuppose.net
- DNS ASK do###mister.net
- DNS ASK ag####tmister.net
- DNS ASK se####article.net
- DNS ASK qu####rticle.net
- DNS ASK se###nangry.net
- DNS ASK qu###angry.net
- DNS ASK se####fifteen.net
- DNS ASK qu####ifteen.net
- DNS ASK se###ndried.net
- DNS ASK qu###dried.net
- DNS ASK br####rticle.net
- DNS ASK fl####rticle.net
- DNS ASK br###angry.net
- DNS ASK fl###angry.net
- DNS ASK br####ifteen.net
- DNS ASK fl####ifteen.net
- DNS ASK re###ddried.net
- DNS ASK ga####article.net
- DNS ASK ca####narticle.net
- DNS ASK se####behind.net
- DNS ASK se###nbroad.net
- DNS ASK qu###broad.net
- DNS ASK se#####nderstand.net
- DNS ASK qu####nderstand.net
- DNS ASK br###butter.net
- DNS ASK fl###butter.net
- DNS ASK br###behind.net
- DNS ASK fl###behind.net
- DNS ASK br###broad.net
- DNS ASK fl###broad.net
- DNS ASK br####nderstand.net
- DNS ASK fl####nderstand.net
- DNS ASK ga####butter.net
- DNS ASK be####butter.net
- DNS ASK ga####behind.net
- DNS ASK be####behind.net
- DNS ASK ga###rbroad.net
- DNS ASK be###rbroad.net
- DNS ASK ga#####nderstand.net
- DNS ASK be#####nderstand.net
- DNS ASK tr###butter.net
- DNS ASK qu###behind.net
- DNS ASK qu###butter.net
- DNS ASK ca####nangry.net
- DNS ASK se####butter.net
- DNS ASK la###angry.net
- DNS ASK ca####nfifteen.net
- DNS ASK la####ifteen.net
- DNS ASK ca####ndried.net
- DNS ASK la###dried.net
- DNS ASK de####article.net
- DNS ASK ni####rticle.net
- DNS ASK de###eangry.net
- DNS ASK ni###angry.net
- DNS ASK de####fifteen.net
- DNS ASK ni####ifteen.net
- DNS ASK de###edried.net
- DNS ASK ni###dried.net
- DNS ASK do####rticle.net
- DNS ASK ag####tarticle.net
- DNS ASK do###angry.net
- DNS ASK ag####tangry.net
- DNS ASK do####ifteen.net
- DNS ASK ag####tfifteen.net
- DNS ASK do###dried.net
- DNS ASK ag####tdried.net
- DNS ASK la####rticle.net
- DNS ASK ni###mister.net
Miscellaneous
Creates and executes the following
- 'C:\wcneprogrigjtjz\m6pksot3tdan4ozrp.exe'
- 'C:\wcneprogrigjtjz\gctcymbfjgmf.exe'
- 'C:\wcneprogrigjtjz\iswtwfuxqiv.exe' "c:\wcneprogrigjtjz\gctcymbfjgmf.exe"
